@spool-lab/core 0.4.1 → 0.4.20

package/dist/security/purge.js

@@ -0,0 +1,159 @@
+// Purge mechanism — the only destructive action in the Security
+// Scan feature.
+//
+// What it does: rewrites the raw secret in `messages.content_text`
+// with the per-kind mask from @spool-lab/redact (e.g. `[redacted:
+// AWS key]`), flips the finding to `state='purged'`, recomputes the
+// session's denormalised counts, and lets the existing FTS triggers
+// sync messages_fts automatically.
+//
+// What it does NOT do: touch the source transcript file in
+// `~/.claude/sessions/`, the `.spool` exports the user may already
+// have published, or OS backups of `spool.db`. Those are Phase 2/3
+// vault concerns documented in the spec.
+//
+// Bulk-by-message ordering: when several findings sit in the same
+// message, apply them in DESCENDING start_offset order so earlier
+// offsets stay valid as the string shifts.
+import { Data, Effect } from 'effect';
+import { maskValueByKind } from '@spool-lab/redact';
+import { updateSessionCounts } from './repo.js';
+export class PurgeError extends Data.TaggedError('PurgeError') {
+}
+/** Purge one finding. Idempotent on "already purged" → returns a
+ *  PurgeError so the UI can surface a no-op. */
+export function purgeFinding(findingId, deps) {
+    return Effect.gen(function* () {
+        const row = yield* Effect.try({
+            try: () => deps.db.prepare(`SELECT id, session_id, message_id, kind, start_offset, end_offset, state
+             FROM findings WHERE id = ?`).get(findingId),
+            catch: (cause) => new PurgeError({ findingId, reason: 'db-failed', cause }),
+        });
+        if (!row) {
+            return yield* Effect.fail(new PurgeError({ findingId, reason: 'not-found' }));
+        }
+        if (row.state === 'purged') {
+            return yield* Effect.fail(new PurgeError({ findingId, reason: 'already-purged' }));
+        }
+        if (row.message_id === null) {
+            return yield* Effect.fail(new PurgeError({ findingId, reason: 'message-missing' }));
+        }
+        const messageId = row.message_id;
+        const kind = row.kind;
+        const result = yield* Effect.try({
+            try: () => applyPurgeTxn(deps.db, row, messageId, kind),
+            catch: (cause) => new PurgeError({ findingId, reason: 'db-failed', cause }),
+        });
+        yield* deps.publish({
+            type: 'state-changed',
+            sessionId: row.session_id,
+            findingId: row.id,
+            state: 'purged',
+        });
+        return result;
+    });
+}
+/** Bulk purge across many findings. Caller passes an arbitrary
+ *  ordering; we re-sort to the only correct order:
+ *
+ *    1. Group by `message_id`
+ *    2. Within each group, apply in **descending** `start_offset` so
+ *       earlier offsets stay valid as the string shifts.
+ *
+ *  Without this re-sort, two findings inside the same message at
+ *  offsets [10..20] and [40..60] would corrupt: purging [10..20]
+ *  first shifts everything after offset 20 by `mask.length - 10`,
+ *  and the second slice [40..60] now points at the wrong bytes
+ *  (often leaking part of the second secret into the mask, or
+ *  losing it entirely). */
+export function purgeFindings(findingIds, deps) {
+    return Effect.gen(function* () {
+        // Resolve offsets/message ids up front so we can deterministically
+        // order. The Effect.try preserves db-failure → PurgeError mapping.
+        const ordered = yield* Effect.try({
+            try: () => orderForBulkPurge(deps.db, findingIds),
+            catch: (cause) => new PurgeError({ findingId: -1, reason: 'db-failed', cause }),
+        });
+        const out = [];
+        for (const id of ordered) {
+            const result = yield* purgeFinding(id, deps).pipe(Effect.catchTag('PurgeError', (err) => err.reason === 'already-purged'
+                ? Effect.succeed(null)
+                : Effect.fail(err)));
+            if (result)
+                out.push(result);
+        }
+        return out;
+    });
+}
+/** Produce a purge order that's safe against offset drift. Findings
+ *  with `message_id IS NULL` (orphan rows that the schema permits but
+ *  should never happen in practice) fall to the end so they don't
+ *  interfere with message-grouped batches.
+ *
+ *  Exported only for tests. */
+export function orderForBulkPurge(db, findingIds) {
+    if (findingIds.length === 0)
+        return [];
+    const placeholders = findingIds.map(() => '?').join(',');
+    const rows = db.prepare(`SELECT id, message_id, start_offset
+       FROM findings
+      WHERE id IN (${placeholders})`).all(...findingIds);
+    const byMessage = new Map();
+    for (const r of rows) {
+        const key = r.message_id;
+        let bucket = byMessage.get(key);
+        if (!bucket) {
+            bucket = [];
+            byMessage.set(key, bucket);
+        }
+        bucket.push({ id: r.id, start_offset: r.start_offset });
+    }
+    for (const bucket of byMessage.values()) {
+        bucket.sort((a, b) => b.start_offset - a.start_offset);
+    }
+    // Stable iteration order over the messages doesn't matter for
+    // correctness — purges in different messages can't shift each
+    // other's offsets. We sort by message_id (nulls last) for
+    // determinism in tests.
+    const messageKeys = [...byMessage.keys()].sort((a, b) => {
+        if (a === null)
+            return 1;
+        if (b === null)
+            return -1;
+        return a - b;
+    });
+    const out = [];
+    for (const key of messageKeys) {
+        for (const r of byMessage.get(key))
+            out.push(r.id);
+    }
+    return out;
+}
+function applyPurgeTxn(db, finding, messageId, kind) {
+    const msg = db.prepare('SELECT content_text FROM messages WHERE id = ?').get(messageId);
+    if (!msg) {
+        throw new Error(`Message ${messageId} disappeared between read and purge`);
+    }
+    const original = msg.content_text.slice(finding.start_offset, finding.end_offset);
+    const mask = maskValueByKind(original, kind);
+    const purgedAt = new Date().toISOString();
+    db.transaction(() => {
+        const newText = msg.content_text.slice(0, finding.start_offset) +
+            mask +
+            msg.content_text.slice(finding.end_offset);
+        db.prepare('UPDATE messages SET content_text = ? WHERE id = ?')
+            .run(newText, messageId);
+        db.prepare(`UPDATE findings
+          SET state = 'purged',
+              state_changed_at = ?
+        WHERE id = ?`).run(purgedAt, finding.id);
+        updateSessionCounts(db, finding.session_id);
+    })();
+    return {
+        findingId: finding.id,
+        sessionId: finding.session_id,
+        maskUsed: mask,
+        purgedAt,
+    };
+}
+//# sourceMappingURL=purge.js.map

package/dist/security/purge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.js","sourceRoot":"","sources":["../../src/security/purge.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gBAAgB;AAChB,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,oEAAoE;AACpE,oEAAoE;AACpE,mCAAmC;AACnC,EAAE;AACF,2DAA2D;AAC3D,mEAAmE;AACnE,mEAAmE;AACnE,yCAAyC;AACzC,EAAE;AACF,kEAAkE;AAClE,kEAAkE;AAClE,2CAA2C;AAE3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGrC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAG/C,MAAM,OAAO,UAAW,SAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,CAI3D;CAAG;AAyBL;gDACgD;AAChD,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,IAAe;IAEf,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC5B,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;wCAC8B,CAC/B,CAAC,GAAG,CAAC,SAAS,CAAgC;YACjD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAC5E,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAA;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAqB,CAAA;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC;YACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAC5E,CAAC,CAAA;QAEF,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAA;QAEF,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;2BAY2B;AAC3B,MAAM,UAAU,aAAa,CAC3B,UAA6B,EAC7B,IAAe;IAEf,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAChC,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;YACjD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAChF,CAAC,CAAA;QAEF,MAAM,GAAG,GAAkB,EAAE,CAAA;QAC7B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CACpC,GAAG,CAAC,MAAM,KAAK,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACrB,CACF,CAAA;YACD,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;+BAK+B;AAC/B,MAAM,UAAU,iBAAiB,CAC/B,EAAqB,EACrB,UAA6B;IAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;qBAEiB,YAAY,GAAG,CACjC,CAAC,GAAG,CAAC,GAAG,UAAU,CAA2E,CAAA;IAE9F,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8D,CAAA;IACvF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAA;QACxB,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAA;IACxD,CAAC;IACD,8DAA8D;IAC9D,8DAA8D;IAC9D,0DAA0D;IAC1D,wBAAwB;IACxB,MAAM,WAAW,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtD,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,CAAA;QACzB,OAAO,CAAC,GAAG,CAAC,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,aAAa,CACpB,EAAqB,EACrB,OAAwB,EACxB,SAAiB,EACjB,IAAmB;IAEnB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,gDAAgD,CACjD,CAAC,GAAG,CAAC,SAAS,CAAyC,CAAA;IACxD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,qCAAqC,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACjF,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAEzC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,MAAM,OAAO,GACX,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;YAC/C,IAAI;YACJ,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC5C,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC;aAC5D,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC1B,EAAE,CAAC,OAAO,CACR;;;qBAGe,CAChB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QAC3B,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC7C,CAAC,CAAC,EAAE,CAAA;IAEJ,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,QAAQ,EAAE,IAAI;QACd,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/security/repo.d.ts

@@ -0,0 +1,141 @@
+import type Database from 'better-sqlite3';
+import type { SensitiveKind } from '@spool-lab/redact';
+import type { FindingRow, FindingState, RiskByCategoryRow, SessionWithFindingCounts } from './types.js';
+export interface FindingFilter {
+    sessionId?: number;
+    kind?: SensitiveKind;
+    /** Multi-select kinds. When non-empty takes precedence over `kind`.
+     *  Used by the Security page filter pills which support clicking
+     *  multiple chips to OR them together. */
+    kinds?: readonly SensitiveKind[];
+    state?: FindingState | 'any';
+    severity?: 'high' | 'low';
+    limit?: number;
+    offset?: number;
+}
+export interface SessionFindingFilter {
+    kind?: SensitiveKind;
+    kinds?: readonly SensitiveKind[];
+    state?: FindingState | 'any';
+    severity?: 'high' | 'low';
+    /** Free-text on session title. */
+    text?: string;
+    limit?: number;
+    offset?: number;
+}
+export interface Page<T> {
+    rows: T[];
+    hasMore: boolean;
+}
+export interface FindingInput {
+    sessionId: number;
+    messageId: number | null;
+    kind: SensitiveKind;
+    valueHash: string;
+    confidence: number;
+    provider: string;
+    startOffset: number;
+    endOffset: number;
+    /** Allowlist hit at insert time → 'dismissed'; else 'active'. */
+    state: FindingState;
+}
+/** Insert a batch of findings. Caller wraps in a transaction. */
+export declare function insertFindings(db: Database.Database, rows: readonly FindingInput[]): void;
+/** Delete all non-purged rows for the providers being rescanned —
+ *  i.e. wipe the producer's previous output so the upcoming
+ *  `insertFindings` is the canonical truth.
+ *
+ *  Includes `state='dismissed'` deliberately: those rows are derived
+ *  state. The user's "ignore" decisions live in `allowlist_session`
+ *  and `allowlist_global` (preserved here), and the scan path
+ *  re-emits findings as `state='dismissed'` whenever it encounters a
+ *  hit that matches an allowlist row. Re-inserting also keeps
+ *  `findings.value_hash` aligned with the per-kind allowlist
+ *  preference (security.json `kindAllowlist`) — without this delete,
+ *  a mute → unmute cycle would accumulate phantom dismissed rows
+ *  (one set per cycle), inflating audit counts and breaking
+ *  `riskByCategory` totals over time.
+ *
+ *  Purged rows are the only state that's NOT producer-derived —
+ *  they correspond to destructive `messages.content_text` rewrites
+ *  the user explicitly approved. Preserving them is the audit
+ *  contract documented in the design doc. */
+export declare function deleteRefreshableFindings(db: Database.Database, sessionId: number, providers: readonly string[]): void;
+/** @deprecated Renamed to {@link deleteRefreshableFindings} after the
+ *  active-only filter was found to leak phantom dismissed rows
+ *  across mute→unmute cycles. Kept as a thin alias so callers
+ *  outside the repo don't break mid-stack. */
+export declare const deleteActiveFindings: typeof deleteRefreshableFindings;
+/** Recompute sessions.scan_finding_count + scan_high_count from the
+ *  findings table.
+ *
+ *  Counts EXCLUDE info-tier kinds (absolute-path, ip, internal-host).
+ *  Those are stored — useful for an opt-in "Show informational
+ *  signals" toggle — but they don't drive the Library row badge
+ *  because their pattern-only signal has too high a false-positive
+ *  rate to be meaningful at first glance. */
+export declare function updateSessionCounts(db: Database.Database, sessionId: number): void;
+export declare function setSessionScanProfile(db: Database.Database, sessionId: number, profile: string, completedAt: string): void;
+/** Set every session's scan_profile to NULL — used by "Rescan all" so
+ *  every session re-enqueues. */
+export declare function invalidateAllScanProfiles(db: Database.Database): number;
+/** Drop the scan profile for one session — used by the sync cascade
+ *  when a session's messages change after first scan. */
+export declare function invalidateSessionScanProfile(db: Database.Database, sessionId: number): void;
+/** Sessions whose stored profile doesn't structurally match
+ *  `currentProfile`. Used at boot for backfill enqueue. */
+export declare function listSessionsNeedingScan(db: Database.Database, currentProfile: string): number[];
+export declare function listFindings(db: Database.Database, filter: FindingFilter): FindingRow[];
+export declare function listFindingsPage(db: Database.Database, filter: FindingFilter): Page<FindingRow>;
+export declare function listSessionsWithFindings(db: Database.Database, filter: SessionFindingFilter): SessionWithFindingCounts[];
+export declare function listSessionsWithFindingsPage(db: Database.Database, filter: SessionFindingFilter): Page<SessionWithFindingCounts>;
+/** Total distinct sessions matching the same filter as
+ *  `listSessionsWithFindings` — used by the renderer to show
+ *  "涉及 N 个会话" without loading every page. Cheaper than the list
+ *  query: no SELECT projection, no GROUP BY, no ORDER BY. */
+export declare function countSessionsWithFindings(db: Database.Database, filter: SessionFindingFilter): number;
+/** Risk by category — one row per kind that has ≥ 1 active finding.
+ *  Drives the Watchtower-style panel on the Security page. */
+export declare function riskByCategory(db: Database.Database): RiskByCategoryRow[];
+/** Read the live raw value for one finding. Used by the UI's review
+ *  panel and the Purge confirm dialog. Returns null when the finding
+ *  no longer points at a valid message (race against session
+ *  deletion) or has been purged (offsets now point at the mask). */
+export declare function getFindingValue(db: Database.Database, findingId: number): string | null;
+/** Bulk version of `getFindingValue` — one SQL query for N finding
+ *  ids instead of N round-trips. Caller fans the result map back out
+ *  by id; missing keys are treated as `null` (purged / vanished). */
+export declare function getFindingValues(db: Database.Database, findingIds: readonly number[]): Record<number, string | null>;
+export interface AllowlistSnapshot {
+    /** (kind|value_hash) keys for this session. */
+    session: Set<string>;
+    /** (kind|value_hash) keys, global scope. */
+    global: Set<string>;
+}
+export declare function getAllowlists(db: Database.Database, sessionId: number): AllowlistSnapshot;
+export declare function isAllowlisted(allow: AllowlistSnapshot, kind: SensitiveKind, valueHash: string): boolean;
+export declare function addAllowlistSession(db: Database.Database, sessionId: number, kind: SensitiveKind, valueHash: string): void;
+export declare function addAllowlistGlobal(db: Database.Database, kind: SensitiveKind, valueHash: string): void;
+export declare function removeAllowlistSession(db: Database.Database, sessionId: number, kind: SensitiveKind, valueHash: string): void;
+export declare function removeAllowlistGlobal(db: Database.Database, kind: SensitiveKind, valueHash: string): void;
+export interface AllowlistEntryRow {
+    scope: 'session' | 'global';
+    kind: SensitiveKind;
+    valueHash: string;
+    createdAt: string;
+    /** Session row context — null for global entries. */
+    sessionUuid: string | null;
+    sessionTitle: string | null;
+}
+/** All allowlist rows from both tables, joined with the originating
+ *  session metadata. Drives the Settings → Security pane's "Manage…"
+ *  modal so the user can review and revoke past decisions. */
+export declare function listAllowlistEntries(db: Database.Database): AllowlistEntryRow[];
+/** Flip a finding to 'dismissed' and, depending on scope, write the
+ *  allowlist entry so future rescans honor the decision. Caller
+ *  wraps in a transaction. */
+export declare function dismissFinding(db: Database.Database, findingId: number, scope: 'session' | 'global'): void;
+/** Re-activate a dismissed finding and remove the allowlist entry
+ *  that pinned it (both scopes, since UI doesn't always know which). */
+export declare function undismissFinding(db: Database.Database, findingId: number): void;
+//# sourceMappingURL=repo.d.ts.map

package/dist/security/repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/security/repo.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,YAAY,CAAA;AAsCnB,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB;;8CAE0C;IAC1C,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE,YAAY,GAAG,KAAK,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE,YAAY,GAAG,KAAK,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACzB,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,IAAI,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,EAAE,CAAA;IACT,OAAO,EAAE,OAAO,CAAA;CACjB;AAID,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,aAAa,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,KAAK,EAAE,YAAY,CAAA;CACpB;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,YAAY,EAAE,GAAG,IAAI,CAsBzF;AAED;;;;;;;;;;;;;;;;;;6CAkB6C;AAC7C,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,IAAI,CASN;AAED;;;8CAG8C;AAC9C,eAAO,MAAM,oBAAoB,kCAA4B,CAAA;AAI7D;;;;;;;6CAO6C;AAC7C,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAwBlF;AAWD,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,IAAI,CAMN;AAED;iCACiC;AACjC,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAGvE;AAED;yDACyD;AACzD,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAO3F;AAED;2DAC2D;AAC3D,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,cAAc,EAAE,MAAM,GACrB,MAAM,EAAE,CAaV;AAID,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,GAAG,UAAU,EAAE,CAuCvF;AAaD,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,aAAa,GACpB,IAAI,CAAC,UAAU,CAAC,CAElB;AA0DD,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,oBAAoB,GAC3B,wBAAwB,EAAE,CAkE5B;AAED,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CAAC,wBAAwB,CAAC,CAEhC;AAED;;;6DAG6D;AAC7D,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,oBAAoB,GAC3B,MAAM,CAYR;AAED;8DAC8D;AAC9D,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,iBAAiB,EAAE,CAgBzE;AAED;;;oEAGoE;AACpE,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYvF;AAED;;qEAEqE;AACrE,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CA4B/B;AAID,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACpB,4CAA4C;IAC5C,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACpB;AAID,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAWzF;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAGT;AAED,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,GAChB,IAAI,CAKN;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,GAChB,IAAI,CAIN;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,GAChB,IAAI,CAKN;AAED,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,GAChB,IAAI,CAIN;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC3B,IAAI,EAAE,aAAa,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;8DAE8D;AAC9D,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,iBAAiB,EAAE,CA4C/E;AAID;;8BAE8B;AAC9B,wBAAgB,cAAc,CAC5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,QAAQ,GAC1B,IAAI,CAiBN;AAED;wEACwE;AACxE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAc/E"}